vBulletin, spammy user stuff, and deleting accounts

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Joe Siegler
    Senior Member
    • Feb 2006
    • 218
    • 4.2.X

    [Forum] vBulletin, spammy user stuff, and deleting accounts

    This morning I ran into a new kind of spammy account I had never run into before. I wanted to report on it so others could be aware of it. Additionally, my dealing with the cleaning up exposed a fault in the vBulletin admin area. Not that it's a bug, but a failing of the system that would have MUCH easily let me deal with this.

    I had a user report a couple of user accounts saying they looked like they could cause trouble. See if you can detect the smiliarity:

    Blossomseo
    Butterflyseo
    Canaceseo
    Damaraseo
    Emmaseo
    Farrahseo
    Gamilaseo
    Hadaraseo
    Malinaseo
    Nabilaseo
    Olatheseo
    Sarahgolfseo
    Tabithaseo
    Tallulahseo
    Yasminseo
    Zerlindaseo
    Zsuzsaseo

    They all were registered from the same IP (119.85.207.249), and all had some sort of "golf" theme in their info. But that's the key. Most spammy accounts flood the forums with posts. They get reported by users and then removed. But these "seo" ones don't do that. They put their spammy info in their profile. So it's seen on their profile page "About Me" info. Additionally these accounts posted "visitor messages" on each other's accounts with addtl spammy links and whatnot.

    That's deceptive as the majority of people never bother looking at other's "about me" info or their visitor messages, so it would go undetected. In fact, that batch of names above was only discovered because one of my forums regulars noticed a bunch of new accounts all ending in "seo", and looked into it.

    Once I started looking in the back end, I saw they all had the same IP, had ZERO posts, and they all had the same text on their profiles. I decided to look for addtl accounts, and searched my userbase for any name that had "seo" in it. Annoyingly there was about 100 or so that matched it. I looked at the majority of them, and all but ONE had zero posts. The one that did have posts was already banned for posting spammy msgs. But all the rest were active accounts, and all of them had similar kind of setups. Spammy stuff of a similar nature to the golf posts, but about different subjects. Given the info was spread out in a few places in their accounts, I opted not to just ban then, but outright delete them. Mostly because I didn't want to spend the addtl time banning all the relevant spammy links too. Was way easier in this regard to just nuke the accounts. Some of these accounts went back to 2009, but most were in 2011. It annoys me that my forums had spammy links in their harvested data by Google. I'm usually pretty on top of this stuff, but going through the user profile stuff and not drawing attention to themselves by posting spammy msgs is a new track for me.

    This brings me to the problem with vBulletin. There's no way I could find to tell vB to search for a user name (in this case, seo), show me the results, and then allow me to bulk delete them. I had to delete them all one by one. This is epic fail in terms of dealing with stuff like this. There is ways to bulk delete users sure, but they have to be part of an existing usergroup. You could create a dummy usergroup, move these users into it, and delete that way, but if you have to manually edit each profile to do that, you might as well just delete them there, as you're creating more work for yourself. It's pretty stupid that the back end doesn't have the ability to "search for any user account that has ceo in the user name and delete it" (presumably after giving me a confirmation screen showing me who matches that search). This needs to be added. If it IS in there, it's horribly hidden and needs to be brought out to the light.

    Finally, there was no user in my userbase that had "seo" in their name for a legit purpose, so I stuck "seo" (without quotes) in my list of things for usernames that is unacceptable.

    Wanted to pass this on so some others could be aware of this kind of thing and check their own forums.
    Last edited by Joe Siegler; Tue 27 Sep '11, 7:46pm. Reason: typo correction
    Joe Siegler - Webmaster
    Black Sabbath Online
  • TheNewOne
    Senior Member
    • Aug 2011
    • 1033
    • 4.2.5

    #2
    use spam o matic from vbulletin.org it will stop them from registering

    Comment

    • Joe Siegler
      Senior Member
      • Feb 2006
      • 218
      • 4.2.X

      #3
      I already use stopforumspam - which stops most stuff, but if you look at the kind of user accounts these are, they would mostly bypass auto spam things like that.
      Joe Siegler - Webmaster
      Black Sabbath Online

      Comment

      • Ace
        Senior Member
        • Apr 2004
        • 4051
        • 4.2.X

        #4
        Originally posted by Joe Siegler
        I already use stopforumspam - which stops most stuff, but if you look at the kind of user accounts these are, they would mostly bypass auto spam things like that.
        How'd they manage to bypass that? Their IP address should have been in the SFS database..
        My Live vB5 Site - NZEating.com
        vBulletin Hosting | vBulletin Services - Need hosting for your vB? Need it installed? Something else? Let me take that hassle off your hands.

        Comment

        • Joe Siegler
          Senior Member
          • Feb 2006
          • 218
          • 4.2.X

          #5
          Not sure. Only thing I can come up with is the connection to there was broken at the time they registered, or their IP simply wasn't in the database. It happens.
          Joe Siegler - Webmaster
          Black Sabbath Online

          Comment

          • Andy
            Senior Member
            • Jan 2002
            • 5886
            • 4.1.x

            #6
            Here's what I do to keep spammers from registering.

            Comment

            • Joe Siegler
              Senior Member
              • Feb 2006
              • 218
              • 4.2.X

              #7
              Originally posted by Andy
              Here's what I do to keep spammers from registering.

              https://www.vbulletin.com/forum/show...-on-your-forum
              I've done all that. I'm not a neophyte here, which is why I posted in the first place. Was something NEW to me.
              Joe Siegler - Webmaster
              Black Sabbath Online

              Comment

              • TheNewOne
                Senior Member
                • Aug 2011
                • 1033
                • 4.2.5

                #8

                Comment

                widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                Working...